## Is Your Bitcoin Exposed to a Quantum Computer Attack?

**6.9 million Bitcoin — roughly a third of circulating supply — sit in addresses where a sufficiently capable quantum computer could derive the private key and drain the wallet without any action by the owner.** A March 2026 paper from [Google Quantum AI](https://quantumintel.tech/companies/google-quantum-ai) quantified the exposure, identifying these coins as vulnerable to what researchers call an *at-rest attack*: because the full public key is already recorded on-chain, a future quantum adversary needs no interaction with the holder. It can work offline, at leisure, against a cryptographic problem the Bitcoin protocol was never designed to defend against at quantum scale.

The same paper flagged approximately 20.5 million Ethereum in similarly exposed accounts. Every standard Ethereum account publishes its public key upon its first signed transaction, meaning most active ETH balances are already exposed.

Whether your own coins are at risk depends entirely on two factors: the address type used, and whether that address has ever broadcast a spend transaction. Neither requires the holder to have made a security mistake. The exposure is a structural property of the address format, not a user error.

---

## Which Bitcoin Address Types Are Vulnerable

**P2PK (Pay-to-Public-Key):** Used extensively in Bitcoin's first years, P2PK outputs embed the full public key directly in the output script. Every coin in a P2PK address has been exposed since the moment it was funded — no spend required.

**Reused P2PKH (Pay-to-Public-Key-Hash):** P2PKH addresses store only a hash of the public key, which a quantum computer cannot reverse. The vulnerability arises the moment a spend transaction is broadcast: the full public key is published on-chain. Any coins subsequently sent back to that same address inherit the exposure. Reused P2PKH addresses account for the majority of the 6.9 million BTC figure.

**Taproot:** Bitcoin's newest common output format, active since November 2021, places the public key on-chain by design. A Taproot address is exposed from the moment it is funded, regardless of spend history.

**Safe formats (until first spend):** P2PKH, P2WPKH, P2SH, and P2WSH addresses that have *never* signed a transaction store only a hash. The underlying key remains hidden. Once any of these addresses broadcasts a spend, the key is public and the address joins the exposed pool.

The practical rule: if an address has ever appeared as an input in a transaction, assume the public key is on-chain.

---

## The Satoshi-Era Problem That Has No Solution

Coinbase's Independent Advisory Board on Quantum estimates approximately 1.7 million Bitcoin across roughly 20,000 early P2PK keys are Satoshi-era or otherwise lost. The source article values these at approximately $131 billion at a price of $77,400 per BTC — though Bitcoin's price at time of publication may differ from that figure.

This creates the hardest policy problem in the quantum-Bitcoin debate. These coins cannot be migrated to quantum-safe addresses because the private keys are gone. The Bitcoin community faces a binary choice with no clean answer:

- **Set a migration deadline** (freeze coins not moved by a specific block height): protects the chain's integrity, but permanently destroys the lost coins — an effective confiscation that sets a troubling precedent.
- **No deadline**: preserves the status quo, but whoever operates the first cryptographically capable quantum computer could silently drain wallets before any warning reaches holders, and 1.7 million BTC hitting exchanges simultaneously would be a market event without precedent.

Neither path is obviously correct, and Bitcoin has ratified no upgrade comparable to Ethereum's stated target of quantum resistance by December 2029 or Ripple's 2028 mainnet amendment, per the source.

---

## Timeline Asymmetry Is the Core Risk

The relevant question is not whether current quantum hardware can break elliptic curve cryptography — it cannot, by a wide margin. The question is the gap between *when a capable system exists* and *when Bitcoin's protocol is upgraded to defend against it*.

[Fault-tolerant quantum computing](https://quantumintel.tech/glossary/fault-tolerant-quantum-computing) at the scale needed to threaten ECDSA-256 requires [logical qubits](https://quantumintel.tech/glossary/logical-qubit) operating well [below threshold](https://quantumintel.tech/glossary/below-threshold) with error correction overhead that current systems cannot sustain. No public roadmap places that capability within the next few years. But protocol upgrades on Bitcoin's mainnet require broad consensus and extended deployment windows — historically measured in years. The asymmetry is structural: the defense must be deployed before the threat matures, not after.

The 6.9 million BTC figure assumes no upgrade occurs. If Bitcoin adopts post-quantum signature schemes before capable hardware exists, the exposure shrinks to a migration execution problem. If it does not, every exposed key becomes a time-limited liability.

---

## What Holders Can Do Now

1. **Audit address type:** Blockchain explorers can identify whether an address is P2PK, P2PKH, P2WPKH, P2SH, P2WSH, or Taproot. This is publicly visible.
2. **Check spend history:** If a hashed address (P2PKH, P2WPKH, P2SH, P2WSH) has appeared as a transaction input even once, the public key is on-chain.
3. **Migrate to a fresh, unspent hashed address:** Moving funds to a new P2WPKH or P2SH address that has never been spent from eliminates current exposure — until that address is itself spent from.
4. **Avoid address reuse:** The single most effective behavioral change. Never send funds back to an address that has broadcast a spend transaction.
5. **Watch protocol governance:** Bitcoin Improvement Proposals related to post-quantum signature schemes represent the only systemic fix. Their progress — or absence — is the indicator that matters most.

---

## Key Takeaways

- **6.9 million BTC** are in addresses where the full public key is visible on-chain, per a March 2026 Google Quantum AI paper, making them vulnerable to an at-rest quantum attack.
- **~20.5 million ETH** face equivalent exposure in standard Ethereum accounts, per the same source.
- **P2PK and Taproot** addresses are exposed from funding. **Hashed addresses** (P2PKH, P2WPKH, P2SH, P2WSH) become exposed the first time they sign a transaction.
- **~1.7 million BTC** in Satoshi-era P2PK keys are estimated lost and cannot be migrated, per Coinbase's Independent Advisory Board on Quantum.
- **Ethereum targets quantum resistance by December 2029; Ripple targets a 2028 mainnet amendment.** Bitcoin has no ratified equivalent timeline.
- No current quantum hardware can break ECDSA-256. The risk is the gap between future hardware capability and protocol upgrade deployment.

---

## Frequently Asked Questions

**How many Bitcoin are exposed to quantum attack?**
A March 2026 paper from Google Quantum AI identified approximately 6.9 million Bitcoin in addresses where the full public key is already visible on-chain — roughly a third of circulating supply. These are vulnerable to an at-rest quantum attack without any further action by the holder.

**Which Bitcoin address types are safe from quantum computers?**
P2PKH, P2WPKH, P2SH, and P2WSH addresses that have *never* broadcast a spend transaction store only a hash of the public key, which current quantum approaches cannot reverse. Once any such address signs a transaction, the public key is published and the address joins the exposed pool. P2PK and Taproot addresses are exposed from the moment they are funded.

**Can Satoshi's Bitcoin be stolen by a quantum computer?**
Approximately 1.7 million Bitcoin in early P2PK keys are believed lost or belonging to Satoshi, per Coinbase's Independent Advisory Board on Quantum. These keys are quantum-exposed, and because the private keys are gone, they cannot be migrated to a safer format. A capable quantum adversary could theoretically claim them.

**Is Ethereum more exposed to quantum attack than Bitcoin?**
By design, standard Ethereum accounts publish their public key on the first signed transaction, meaning most active ETH balances are already exposed. The Google Quantum AI paper flagged approximately 20.5 million ETH in this position. However, Ethereum has an explicit quantum-resistance target of December 2029, while Bitcoin has no ratified equivalent.

**What can Bitcoin holders do to reduce quantum risk today?**
Move funds to a fresh, unspent hashed address (P2WPKH recommended), never reuse addresses, and audit existing holdings for exposure using a blockchain explorer. The only systemic solution is a Bitcoin protocol upgrade adopting post-quantum signatures — a governance process that has not yet formally begun.